Nomi Technologies Settles Charges It Misled Consumers About Opt-Out Choices

FTC sues NomiThe FTC has announced it has reached a settlement with Nomi Technologies over charges that the retail tracking company misled consumers.  Nomi is one of several companies that have developed ways to use a consumer’s mobile device to track their real world movements for commercial purposes.  The company would use in-store censors to collect a mobile device’s MAC address when the device searched for Wi-Fi networks, which most devices do almost constantly by default.  The movements of consumers both inside and outside these stores were then tracked using their device’s MAC address.

Nomi purportedly collected information on approximately nine million mobile devices during the first nine months of 2013 using a technique called “hashing” to obscure MAC addresses that could be used to identify a particular smart device.  However, Nomi still generated a unique code that was associated with each device allowing the device to be tracked over time.  While the reports generated by the Nomi program didn’t share information about specific shoppers, the FTC found Nomi had violated its own privacy policy.

According to the FTC’s complaint, Nomi misled consumers with promises that it would provide an in-store mechanism for consumers to opt out of being tracked, and that consumers would be informed when locations were using Nomi’s services.  In late 2012, Nomi’s privacy policy promised that the company would create an opt-out mechanism at stores utilizing Nomi’s services.  While promised, the in-store opt out mechanism was never made available to consumers, the FTC alleges.  In fact, in most instances consumers were never even informed that they were being tracked in the first place.  The only way for consumers to opt out of being tracked was through Nomi’s website, which ran counter the company’s privacy policy, which read that Nomi “pledged to… always allow consumers to opt out of Nomi’s service on its website, as well as at any retailer using Nomi’s technology.”

Under the terms of the settlement, Nomi agreed to abide by its privacy promises and not misrepresent consumers’ options to block being tracked.  Specifically, the FTC’s consent order requires that the company “not misrepresent in any manner, expressly or by implication: (A) the options through which, or the extent to which, consumers can exercise control over the collection, use, disclosure, or sharing of information collected from or about them or their computers or devices, or (B) the extent to which consumers will be provided notice about how data from or about a particular consumer, computer, or device is collected, used, disclosed, or shared.” The settlement includes five years of related FTC oversight, but the order effectively puts the company under FTC surveillance for the next twenty years.

Even still, the FTC’s consent order didn’t receive the unanimous support of the FTC commissioners.  Both Commissioners Joshua Wright and Maureen Ohlhausen dissented.  Ohlhausen pointed out that “as a third party contractor collecting no personally identifiable information, Nomi had no obligation to offer consumers an opt out,” but did anyway.  So having caused no consumers any known harm, she didn’t think that Nomi should have been subject to “a de facto strict liability approach to a young company that attempted to go above and beyond its legal obligation to protect consumers but, in so doing, erred without benefiting itself.”  Ohlhausen worries that this settlement will only encourage companies to do the “bare minimum on privacy.”

Wright similarly felt that “aggressive prosecution of this sort will inevitably deter industry participants like Nomi from engaging in voluntary practices that promote consumer choice and transparency – the very principles that lie at the heart of the Commission’s consumer protection mission.  Nomi was under no legal obligation to post a privacy policy, describe its practices to consumers, or to offer an opt-out mechanism.  To penalize a company for such a minor shortcoming – particularly when there is no evidence the misrepresentation harmed consumers – sends a dangerous message to firms weighing the costs and benefits of voluntarily providing information and choice to consumers.”

While the FTC’s enforcement action against Nomi Technologies is the first such action against a retail tracking company, retail tracking companies have been coming under increased fire from other sources in recent times.  Senator Chuck Schumer (D-NY), Rep. Jose Serrano (D-NY) and Sen. Al Franken (D-MN) have all gone after companies’ use of such shopper insights tools.  So has the state of Maryland. This is also not the first time the FTC has paid attention either, having held a workshop on the technology in February 2014.  Thus, while Commissioners Ohlhausen and Wright disagree with the charges against Nomi, the FTC and other lawmakers have signaled a warning to companies tracking consumers’ movements.

Nomi Technologies Website